asia pacific life sciences compliance survey 2018 executive summary · 2018. 9. 9. · executive...

Asia Pacific Life Sciences Compliance Survey 2018Executive Summary

APAC compliance survey 2018 v1.indd 1 9/6/2018 5:33:59 PM

Asia Pacific Life Sciences Compliance Survey 2018 | Executive Summary

2

Key findings

01. Compliance function benchmarking – The majority of Life Sciences companies in Asia Pacific (APAC) have compliance reporting into an independent regional/global function. However, high variability exists in local country team sizes and compliance headcount is not always reflective of local market risks.

02. Compliance culture – A lack of strong ‘speak up culture’ is a high risk in APAC countries with high corruption ratings as compliance incidents may go undetected. The lack of a strong speak up culture is likely due to the fact that most companies do not have an established system of including compliance measurables in the KPIs which define employee bonuses.

03. Compliance maturity – Although compliance maturity is fast improving in APAC, risk articulation and identification and Life Sciences industry understanding are considered emerging capabilities.

04. Compliance monitoring – Compliance monitoring in APAC is still relatively immature. A minority of Life Sciences companies rate their compliance monitoring programs as ‘world class’ and over a quarter of respondents from Pharmaceutical companies shared that their company has not completed a risk assessment in the last 3 years.

05. Third party risk mitigation – Third party risks are significant across many APAC countries, however active mitigation of these risks is under-developed. Third party monitoring programs are widely rated as in need of improvement and more than half of Life Sciences companies are not regularly auditing third parties.

06. Emerging trends and regulations – Support for innovation and use of analytics are becoming a core part of the compliance officer role. However competencies in these areas are still emerging, showing a gap in skill sets to adapt effectively to these changes.



3

Compliance function benchmarking – structure and size

The importance of independent and well resourced compliance organisations has been recognised by the majority of Life Sciences companies in APAC. Smaller companies may not need large teams due to low volume of activities, however there poses potential conflict of interest in cases where the business is responsible for compliance.

Compliance team size in APAC Compliance function reporting lines

• Team size is surprisingly small in India, where the largest local compliance team is 3 headcount. Given the size and risks in the market, this may indicate the low prioritisation amongst the APAC countries.

• China and Southeast Asia are high risk markets, however not all companies have large compliance teams. Medium size companies have a range in team size ranging from 1 to 15 in Southeast Asia and 1 to 20 in China.

• The majority of companies have functional reporting into regional/global compliance. The exception is small companies where reporting is more often into the business. This may be due to limited resources to build an independent compliance function or little need due to low volume of activities.

• Local compliance reporting into Legal function is much more common for Medical Device companies, which is at 30% of companies compared to less than 5% in Pharmaceutical companies

0

5

10

15

20

25

30

35

40

Southeast Asia China(including

Hong Kong)

Japan Oceania(Australia andNew Zealand)

South Korea Taiwan South Asia(India and Pakistan)

Num

ber

of F

TE Report to the Business

Legal

Region/GlobalCompliance

Other

17%10%

62%10%

Com

pliance function



4

Compliance culture and maturity

Compliance culture is driven by tone at the top and integration of compliance in daily operations. Whilst most respondents noted the importance of compliance in company strategic direction as well as the role of compliance champions and senior management, speak up culture and the use of Key Performance Indicators (KPIs) are still developing. This could pose significant risk in APAC countries if employees are not empowered or incentivised to speak openly about non-compliance incidents.

Factors of Compliance culture

Compliance plays a major role inthe strategic direction of the company1Compliance ‘champions’ exist within the organisation 2Senior management is expected to regularlycommunicate with the organisation oncompliance topics (at least quarterly)3Members of Senior Management are part ofthe Compliance Committee4All employees receive Compliance training whenthey join the organisation 5Compliance measurable are part ofperformance metrics (KPIs) 6Strong 'speak up culture’7

Established Emerging Under-developed

0% 20% 40% 60% 80%

Importance ranking % of companies rating of their current maturity



5

Tone at the top

41%

54%

6%

42%

34%

24%

Management shows low/sporadic commitment to the compliance program and initiatives, and does not communicate with the organisationon compliance topics

Management has high level oversight of the compliance program, supports compliance function and communicates compliance topics to the organisation occasionally

Management closely oversees the compliance program, regularly communicating on the importance of compliance and providing consistent support to activities and initiatives

41%

54%

6%

42%

34%

24%Compliance function involved in management meetings and play a key role in business objective setting

Compliance function is consulted during business objective setting

Compliance function is informed of business objectives after they have been decided

43% of respondents shared that compliance function is involved in management meetings and play a key role in setting business objectives, and an additional 34% of respondents shared that compliance function is being consulted. This shows that whilst the majority of companies consider compliance input critical to decision making, there are still a number of companies that do not involve compliance.

In the majority of the Life Sciences companies management supports the compliance function with high level oversight of the program, and communicates with the organisation on compliance topics occasionally.



6

Compliance functions are maturing in APAC with KPIs being used and compliance training being carried out widely. Many of the traditional competencies related to policies and procedures, training and monitoring are well developed however some critical areas such as risk identification and industry understanding are still emerging.

Compliance policies and procedures

Risk identification and articulation

Training and coaching

Business partnering

Compliance monitoring and reporting

Third party risk management

Industry understanding includingbest practice

Data analytics and insights

Analysing and enabling innovativebusiness models

123456789

Importance ranking

0% 20% 40% 60% 80%

Established Emerging Under-developed

% of companies rating of their current maturity

Compliance competencies

• Risk articulation and

identification is rated as

the 2nd most important

competency for compliance

functions, however less

than half of respondents

stated that this capability

is established in their

organisation.

• 67% of respondents stated

that industry understanding

and best practice was

emerging or under-developed

in their organisation

KPIs92% of respondent organisations use KPIs to measure compliance program effectiveness, however there is a wide variety in the indicators used. The most common are internal audit results and number of non-compliance incidents

Compliance trainingNon-compliance function employees in Life Sciences companies largely receive compliance training, however 42% of respondents shared that training is only carried out annually.



7

World Class

10%

Adequate

44%

Inadequate

5%

41%

Could beimproved

2%

12%

7%

18%

11%

31%

19%

Other

Insufficient analytics

Insufficient or unreliable data

Insufficient resources - People

Insufficient resources - Budget

Lack of cooperationfrom third parties

Lack of cooperation frominternal stakeholders/business

Compliance monitoring

Half of respondents rated their own monitoring programs as inadequate and could be improved. Despite respondents constituting 34% of large-sized companies (>50,000 people), only 10% rated themselves as “world class”.

A larger company size implies a more vast/complex operations which would require more budget to monitor these operations. However, only 10% of respondents rated themselves as “world class”. Almost one-third rated “people-related resource limitations” as the key hindrance to evolving into a “world class”, followed by budget constraints and insufficient analytics.

Barriers faced in achieving a 'world class' monitoring program



8

72%

34%

62%

48%

46%

55%

51%

73%

13%

30%

24%

21%

25%

18%

23%

15%

15%

37%

14%

31%

28%

27%

27%

11%

Training monitoring - learning management system

FMV calculation service

Document and policy management

Third party risk management

Transparency reporting (e.g. spend reporting to governmentor industry association)

Tracking of interactions and engagements with HCPs

Consolidation of pre- and post- event/activity documentation

Activities and events approval

Already implemented Plans to implement No plans to implement

Monitoring technology is typically used to manage standardised and voluminous transactions, with clearly defined compliance control points and strong documentation needs. However, for the least-prioritised items, the business case/investment may not be sufficient despite the underlying business risk. Technology may also not be available or sufficiently advanced to satisfactorily achieve their goals.

Top priorities in systems implementation(already and planned): • Activity and Events Approval (88%) • Document and Policy Management (86%) • Training Monitoring (85%)

Least prioritised: • Fair Market Value (FMV) Calculation Service (31%) • Third Party Risk Management (28%) • Transparency Reporting (27%) • Consolidation of Pre- and Post-Event/Activity Documentation • Tracking of interactions and Engagement with Health Care Professionals (HCPs)

Status of implementation of IT systems and tools to support compliance



9

Every 2 years

18%

Every year

70%

Medical Devices

Every 2 years

15%

Every year

52%

33%

Pharmaceutical

12%

We have not performed a risk

assessment or survey in the last 3 years

We have not performed a risk

assessment or survey in the last 3

years

Risk assessments help companies to prioritise and leverage resource allocation, however, industries contrast in their frequency of such assessments.

70% of respondents from Medical Device companies perform risk assessments annually compared to 52% from Pharmaceutical companies.

Surprisingly, results for pharmaceutical companies are polarising. 1 in 3 Pharmaceutical respondents have not done a risk assessment in the last three years (vs 1 in 8 or 12%) of the Medical Device respondents.



10

Adequate24%

Inadequate10%

World Class10%

Could be improved

56%

Third party risk mitigation

In Asia Pacific third parties, particularly distributors, are relied on by many Life Sciences companies. Monitoring of these third parties has been largely rated as inadequate or in need of improvement, and 23% of respondents stated that competency in their organisation is under-developed in this area. This gap poses significant risks for Life Sciences companies in the region.

Frequency of third party audit Rating of Third Party Compliance Monitoring Programs

of companies are not regularly auditing third parties as part of their monitoring program

of respondents commented that their organisations only audit their third parties in case a non-compliance incident arises

of respondents shared that their organisations have never executed their right to audit their third parties

In terms of execution of third party audits, we found that organisation in China completed their audits most regularly (36% annually).

Japan had the highest number of responses stating that organisations had never audited third parties (32%).

56%

28%

28%

Over 66% of companies rated their third party compliance monitoring programs as inadequate or in need of improvement.

23% of organisations stated that third party monitoring competencies were under-developed in their organisation



11

3%

11%

14%

15%

12%

25%

20%

Other

Lack of cooperation from internal stakeholders/business

Lack of cooperation from third parties

Insufficient analytics

Insufficient or unreliable data

Insufficient resources - People

Insufficient resources - Budget

Organisational barriers for a ‘world class’ standard third party compliance monitoring program

6%

28%

10%

28% 28%

Twice a year Annually Less thanonce per year

Only in casea non-compliance

incident arises

We have notexecuted our right

to audit third parties

3% 1%

34%

17%

45%

Monthly Twice a year Annually Less thanonce per year

We do notconduct compliance

training for third parties

Life Sciences companies are limited by insufficient resources to improve their third party monitoring programs. This is reflected in low levels of training being provided and the fact that most organisations do not frequently audit third parties. As a result Life Sciences companies may not be effectively identifying and addressing potentially significant third party risks.

The largest barriers to the improvement of third party compliance monitoring is lack of resources (budget and people), whereas lack of cooperation from internal stakeholders was the lowest barrier

More then half (i.e. 56%) respondents stated that they execute the right to audit third parties only in case of a non-compliance incident or never

More then 60% of the respondents mentioned that their third parties either never receive compliance training or receive training less then once per year

Execute the right to audit third parties Third parties receive compliance training



12

Emerging trends and regulations

As the Life Sciences industry in APAC develops, support of innovation and use of analytics are becoming a core part of a compliance officers role.However competencies in these areas are still emerging, showing a gap in skill sets of compliance to adapt effectively to these changes.

What is the status of analytics implementation across Life Sciences companies?

Supporting innovation

The role of Compliance in supporting business model innovationNo involvement 6%

Reactive42%

Proactive52%

Life Sciences organisations are moving towards innovative business models, where the ways in which they interact with HCPs and Patients are evolving.

94% of respondents said they are involved in supporting these changes, however 37% of respondents said that competency in this area was under-developed.

Data analytics and enabling innovative business models were rated as the least developed compliance competencies amongst respondents

Data analytics

21% 20% 59%

20% 20% 61%

21% 17% 62%

32% 23% 45%

Monitoring program e.g. activity/events monitoring,

Expense monitoring

Red flagging/due diligence

Supplier assurance

No plans to implement Plans to implement Already implemented

Use of analytics is growing in the Life Sciences industry, and the majority of companies have implemented or plan to implement analytics in core business operations. However, only a quarter of respondents rated competency in this area as developed for their organisation.



13

Transparency reporting requirements

Data Privacy Regulations

Other regulations

12

34

5

Regulations/policies limitingdirect sponsorships of HCPs

Anti-bribery and Anti-corruption regulations/policiesrelating to interactions with HCPs and Health Care Organisations (HCOs)

0%

10%

20%

30%

40%

50%

60%

70%

80%

90%

100%

1 2 3 4 5

Pharmaceutical Medical Devices

Priority rating:

Anti-bribery, anti-corruption and policies relating to interactions with HCPs are the highest priority for Life Sciences companies. Respondents also noted adherence to transparency requirements was a priority, which is a reflection of reporting requirements in Japan, Korea and Indonesia.

Policies and regulations

Other regulation include off-label promotion and advertising which is a concern in the Japan market due to the recent MHLW regulations

Rating of prioritisation:

Regulations limiting direct sponsorships of HCPs are of higher concern to Medical Device companies compared to Pharmaceutical companies due to the recent updates to APAC Medical guidelines



14

Biologics Diagnostics

Distribution

Medical Devices

Pharmaceuticals

South KoreaJapan

Taiwan

Southeast Asia

Australia

New Zealand

India & South Asia

Respondent demographics

More than 70 respondents from 24

APAC countries

85% of respondents were Managers and or above

Respondents profile

34%of respondents

45%of respondents

21%of respondents

> 50,000

5,000 – 50,000

< 5,000

Size of the organisation by number of global employees

About APAC Life Sciences Compliance Survey 2018



15

Contacts

Mohit GroverExecutive Director, Risk AdvisoryLife Sciences & Health Care Industry LeaderDeloitte Southeast [email protected]

Sophia DavisonSenior Consultant, Risk AdvisoryLife Sciences and Health Care IndustryDeloitte [email protected]

Howard ChaiManager, Risk AdvisoryLife Sciences and Health Care IndustryDeloitte [email protected]

Jinki HongSenior Consultant, Risk AdvisoryLife Sciences and Health Care IndustryDeloitte [email protected]

Akshi JainManager, Risk AdvisoryLife Sciences and Health Care IndustryDeloitte [email protected]

Izzati AriffinConsultant, Risk AdvisoryLife Sciences and Health Care IndustryDeloitte [email protected]


Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited (“DTTL”), its global network of member firms, and their related entities. DTTL (also referred to as “Deloitte Global”) and each of its member firms are legally separate and independent entities. DTTL does not provide services to clients. Please see www.deloitte.com/about to learn more.

Deloitte is a leading global provider of audit and assurance, consulting, financial advisory, risk advisory, tax and related services. Our network of member firms in more than 150 countries and territories serves four out of five Fortune Global 500® companies. Learn how Deloitte’s approximately 264,000 people make an impact that matters at www.deloitte.com.

About Deloitte Southeast AsiaDeloitte Southeast Asia Ltd – a member firm of Deloitte Touche Tohmatsu Limited comprising Deloitte practices operating in Brunei, Cambodia, Guam, Indonesia, Lao PDR, Malaysia, Myanmar, Philippines, Singapore, Thailand and Vietnam – was established to deliver measurable value to the particular demands of increasingly intra-regional and fast growing companies and enterprises.

Comprising approximately 340 partners and 8,800 professionals in 25 office locations, the subsidiaries and affiliates of Deloitte Southeast Asia Ltd combine their technical expertise and deep industry knowledge to deliver consistent high quality services to companies in the region.

All services are provided through the individual country practices, their subsidiaries and affiliates which are separate and independent legal entities.

About Deloitte SingaporeIn Singapore, services are provided by Deloitte & Touche LLP and its subsidiaries and affiliates.

© 2018 Deloitte & Touche Enterprise Risk Services Pte Ltd


asia pacific life sciences compliance survey 2018 executive summary · 2018. 9. 9. · executive...

Documents